RBL filters not triggered for catchall e-mails?

wattie

wattie

Verified User
Joined
May 31, 2008
Messages
948
Location
Bulgaria
I can confirm that the RBL blocklist is working on my server - the rejectlog is full with messages for blocked spam due to RBL check.

At the same time I have one particular domain with a catchall e-mail address which is receiving hundreds of spam messages from IPs that are listed in RBL blocklists that I am using (the default list that came with the exim.conf).

The even more odd thing is that few (just few compared to the hundreds that are received) spam messages are sent to the same domain and are blocked correctly by RBL according to the rejectlog...

So in this particular case it looks like that RBL blocking is rarely working for that domain.

Could it be because the amount of spam that is sent to that domain is too huge and RBLs are blocking me from querying their database? And is there any way to check that?

I am using exim.conf 4.5.3 + easyspamfighter + blockcracking, etc.. and the latest exim.
 
A bit of investigation - here is a spam message that gone through but the IP of the sender is in the RBLs:

Code: 
Delivery-date: Fri, 10 Mar 2017 12:38:37 +0200
Received: from [23.94.234.53] (helo=01f40f4d.baclorre.bid)
by recipientserver.com with esmtp (Exim 4.89)
(envelope-from <[email protected]>)
id 1cmHwS-000MYb-HE for bg670.info@<recipientdomain.com>; Fri, 10 Mar 2017 12:38:37 +0200
Received: from 01ed0da2.7wqqv32u.baclorre.bid ([127.0.0.1]:11821 helo=7wqqv32u.baclorre.bid) by 7wqqv32u.baclorre.bid with ESMTP id 01MPOTQKRKIED0DQVERXSXEMA2; for <bg670.info@<recipientdomain.com>; Fri, 10 Mar 2017 02:38:31 -0800

the spam score is:

Code: 
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of 
words
1.3 RDNS_NONE Delivered to internal network by a host 
with no rDNS
1.0 HTML_OFF_PAGE HTML element rendered well off the 
displayed page
0.0 T_REMOTE_IMAGE Message contains an external image
SpamTally: Final spam score: 23
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus

Note that the Easy Spam Fighter score is 23 when it should actually add 50 if the IP is in the RBL...
 
Unfortunately these links also show that it still does not block 100%. Some other config (maybe spamblocker) is overriding the ACL so ip's on for example spamhaus still get through.
Even with correct resolvers.
 
You must log in or register to reply here.
Back
Top